navmelding0.com Open in urlscan Pro
91.215.85.79 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://navmelding0.com/pages?d=nordea
Submission: On August 23 via api (August 23rd 2024, 10:52:43 pm UTC) from BE — Scanned from DE

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 13 HTTP transactions. The main IP is 91.215.85.79, located in Russian Federation and belongs to PROSPERO-AS, RU. The main domain is navmelding0.com.
TLS certificate: Issued by R11 on July 19th 2024. Valid for: 3 months.

This is the only time navmelding0.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BankID (Banking)

Domain & IP information

	IP Address	AS Autonomous System
10	91.215.85.79 91.215.85.79	200593 (PROSPERO-AS) (PROSPERO-AS)
3	193.26.146.36 193.26.146.36	207674 (VIPPS-AS) (VIPPS-AS)
13	3

10 91.215.85.79 (Russian Federation)

ASN200593 (PROSPERO-AS, RU)

navmelding0.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 193.26.146.36 (Norway)

ASN207674 (VIPPS-AS, NO)

csfe.bankid.no	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	navmelding0.com navmelding0.com	76 KB
3	bankid.no csfe.bankid.no — Cisco Umbrella Rank: 505966	1 KB
13	2

	Domain	Requested by
10	navmelding0.com	navmelding0.com
3	csfe.bankid.no	navmelding0.com
13	2

This site contains no links.

Subject Issuer	Validity	Valid
*.navmelding0.com R11	`2024-07-19` - `2024-10-17`	3 months	crt.sh
csfe.bankid.no GlobalSign RSA OV SSL CA 2018	`2024-02-26` - `2025-03-29`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://navmelding0.com/pages?d=nordea
Frame ID: DBA81AB9E15E9C4DDD9ABA3DAD3499FB
Requests: 25 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

OIDC Client

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

77 kB
Transfer

358 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
12 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request pages Show response
navmelding0.com/ 57 KB
12 KB 269ms
107ms Document
text/html 91.215.85.79
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://navmelding0.com/pages?d=nordea
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.215.85.79 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software: /
Resource Hash: 91e212c00720ecc2b72ec531f8b6ac7145f8054574918e6d4014a9438609c536

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-length: 11845
content-type: text/html; charset=UTF-8
date: Fri, 23 Aug 2024 22:52:39 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
vary: Accept-Encoding

GET
H2 404 oidc-client.min.js
navmelding0.com/static/bifrost/js/ 0
0 110ms
109ms Script
text/html 91.215.85.79
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://navmelding0.com/static/bifrost/js/oidc-client.min.js?1.1.0-7+274bc17a
Requested by: Host: navmelding0.com
URL: https://navmelding0.com/pages?d=nordea
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.215.85.79 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://navmelding0.com/pages?d=nordea
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
date: Fri, 23 Aug 2024 22:52:39 GMT
cache-control: no-store, no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8

GET
H2 200 oidc-client.min.css
navmelding0.com/front_end/front_end_files/ 51 KB
9 KB 56ms
55ms Stylesheet
text/css 91.215.85.79
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://navmelding0.com/front_end/front_end_files/oidc-client.min.css?1.1.0-7+274bc17a
Requested by: Host: navmelding0.com
URL: https://navmelding0.com/pages?d=nordea
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.215.85.79 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software: /
Resource Hash: 0f701714eca75339b36fb25a551ab035e6ac88cbf1854fa3c5e4c794d43a3fb7

Request headers

Referer: https://navmelding0.com/pages?d=nordea
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 23 Aug 2024 22:52:39 GMT
content-encoding: br
last-modified: Tue, 02 Jan 2024 20:42:04 GMT
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 8694
expires: Fri, 30 Aug 2024 22:52:39 GMT

GET
H2 200 jquery.js Show response
navmelding0.com/js/cntdjs/ 87 KB
30 KB 56ms
55ms Script
text/javascript 91.215.85.79
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://navmelding0.com/js/cntdjs/jquery.js
Requested by: Host: navmelding0.com
URL: https://navmelding0.com/pages?d=nordea
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.215.85.79 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software: /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

Referer: https://navmelding0.com/pages?d=nordea
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 23 Aug 2024 22:52:39 GMT
content-encoding: br
last-modified: Tue, 02 Jan 2024 20:42:04 GMT
accept-ranges: bytes
content-length: 30267
vary: Accept-Encoding
content-type: text/javascript

GET
H2 200 jquery.mask.js Show response
navmelding0.com/js/cntdjs/ 23 KB
5 KB 109ms
108ms Script
text/javascript 91.215.85.79
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://navmelding0.com/js/cntdjs/jquery.mask.js
Requested by: Host: navmelding0.com
URL: https://navmelding0.com/pages?d=nordea
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.215.85.79 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software: /
Resource Hash: a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8

Request headers

Referer: https://navmelding0.com/pages?d=nordea
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 23 Aug 2024 22:52:39 GMT
content-encoding: br
last-modified: Tue, 02 Jan 2024 20:42:04 GMT
accept-ranges: bytes
content-length: 5583
vary: Accept-Encoding
content-type: text/javascript

GET
H2 200 cntd.js Show response
navmelding0.com/js/cntdjs/ 3 KB
920 B 109ms
108ms Script
text/javascript 91.215.85.79
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://navmelding0.com/js/cntdjs/cntd.js
Requested by: Host: navmelding0.com
URL: https://navmelding0.com/pages?d=nordea
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.215.85.79 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software: /
Resource Hash: 5b056148977cddad1d04190e8588f71549f5fbce2c8504fd0a52699a451896ca

Request headers

Referer: https://navmelding0.com/pages?d=nordea
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 23 Aug 2024 22:52:39 GMT
content-encoding: br
last-modified: Tue, 02 Jan 2024 20:42:04 GMT
accept-ranges: bytes
content-length: 889
vary: Accept-Encoding
content-type: text/javascript

GET
H2 200 loading.js Show response
navmelding0.com/js/shared/ 2 KB
695 B 109ms
108ms Script
text/javascript 91.215.85.79
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://navmelding0.com/js/shared/loading.js
Requested by: Host: navmelding0.com
URL: https://navmelding0.com/pages?d=nordea
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.215.85.79 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software: /
Resource Hash: 4bdc871a71df801aa86926434d6fbed9744ec4757af4e9d6d40978724ea59134

Request headers

Referer: https://navmelding0.com/pages?d=nordea
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 23 Aug 2024 22:52:39 GMT
content-encoding: br
last-modified: Tue, 02 Jan 2024 20:42:06 GMT
accept-ranges: bytes
content-length: 640
vary: Accept-Encoding
content-type: text/javascript

GET
H2 200 online_status.js Show response
navmelding0.com/js/shared/ 998 B
437 B 109ms
109ms Script
text/javascript 91.215.85.79
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://navmelding0.com/js/shared/online_status.js
Requested by: Host: navmelding0.com
URL: https://navmelding0.com/pages?d=nordea
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.215.85.79 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software: /
Resource Hash: e64e9d464beb9fe2717cd8bd8d093bb04d570f08a15c65f14533733904e12be7

Request headers

Referer: https://navmelding0.com/pages?d=nordea
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 23 Aug 2024 22:52:39 GMT
content-encoding: br
last-modified: Tue, 02 Jan 2024 20:42:06 GMT
accept-ranges: bytes
content-length: 383
vary: Accept-Encoding
content-type: text/javascript

GET
H2 200 bid_202201130932.css
navmelding0.com/front_end/front_end_files/ 129 KB
17 KB 108ms
108ms Stylesheet
text/css 91.215.85.79
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://navmelding0.com/front_end/front_end_files/bid_202201130932.css
Requested by: Host: navmelding0.com
URL: https://navmelding0.com/pages?d=nordea
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.215.85.79 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software: /
Resource Hash: 68865208ac1cc3b9a6a8bf2e7a8c6e95d90be33bbfd73bb9c682034199f176a4

Request headers

Referer: https://navmelding0.com/pages?d=nordea
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 23 Aug 2024 22:52:39 GMT
content-encoding: br
last-modified: Tue, 02 Jan 2024 20:42:04 GMT
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 17413
expires: Fri, 30 Aug 2024 22:52:39 GMT

GET
H/1.1 200
OK error.js Show response
csfe.bankid.no/jsclient21/ 250 B
608 B 142ms
35ms Script
application/javascript 193.26.146.36
VIPPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://csfe.bankid.no/jsclient21/error.js

Requested by

Host: navmelding0.com
URL: https://navmelding0.com/pages?d=nordea

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_CBC

Server

193.26.146.36 , Norway, ASN207674 (VIPPS-AS, NO),

Reverse DNS

Software

Apache /

Resource Hash

c080371fd384e40ac7de4153b9a05b57a21362ce1f69d1f7ac7af1e28a6fc1e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://navmelding0.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Fri, 23 Aug 2024 22:52:39 GMT
Strict-Transport-Security: max-age=31536000
Last-Modified: Thu, 29 Feb 2024 10:22:18 GMT
Server: Apache
ETag: W/"250-1709202138000"
Content-Type: application/javascript
Cache-Control: max-age=0
Connection: close
Accept-Ranges: bytes
Content-Length: 250
Expires: Fri, 23 Aug 2024 22:52:39 GMT

GET
H/1.1 200
OK KgAAAL2f1cP3S6QFyW7LwEavA4n4LGmaqdgvDrFPGcgpsLJmzcPc2-8XCRQP7z3h_WM6i97fpSLPKwNZOyleBjyk0RCj9p95W2s Show response
csfe.bankid.no/CentralServerFEJS/b/ 108 B
509 B 147ms
40ms Script
application/javascript 193.26.146.36
VIPPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://csfe.bankid.no/CentralServerFEJS/b/KgAAAL2f1cP3S6QFyW7LwEavA4n4LGmaqdgvDrFPGcgpsLJmzcPc2-8XCRQP7z3h_WM6i97fpSLPKwNZOyleBjyk0RCj9p95W2s

Requested by

Host: navmelding0.com
URL: https://navmelding0.com/pages?d=nordea

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_CBC

Server

193.26.146.36 , Norway, ASN207674 (VIPPS-AS, NO),

Reverse DNS

Software

Apache /

Resource Hash

a1f96af0ff80beee233dd05a75843e48337554f85d93f5c533cb42bc8045220e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://navmelding0.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Fri, 23 Aug 2024 22:52:38 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: DENY
Content-Type: application/javascript;charset=UTF-8
Cache-control: no-cache, no-store, must-revalidate, max-age=0
Connection: close
Content-Length: 108
X-XSS-Protection: 1; mode=block
Expires: Fri, 23 Aug 2024 22:52:39 GMT

GET
H/1.1 200
OK helper21.js Show response
csfe.bankid.no/CentralServerFEJS/Gateway/ 0
364 B 149ms
42ms Script
application/javascript 193.26.146.36
VIPPS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://csfe.bankid.no/CentralServerFEJS/Gateway/helper21.js?cid=1i2oCUMt56e3Xq8F

Requested by

Host: navmelding0.com
URL: https://navmelding0.com/pages?d=nordea

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_CBC

Server

193.26.146.36 , Norway, ASN207674 (VIPPS-AS, NO),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://navmelding0.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 23 Aug 2024 22:52:38 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: DENY
Content-Type: application/javascript
Cache-control: no-cache, no-store, must-revalidate
Connection: close
Content-Length: 0
X-XSS-Protection: 1; mode=block
Expires: 0

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 366 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bc795cf00117d34096de8876731329301cb631c7cc5b33cd34d56ec87b917822

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated Show response
/ 0
0 Script
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: text/javascript

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2fbbbda646f6c6004b2f3670d40a1ad4d5df6c8a0089943845aa5fe55a749e92

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 172 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6a191c4d1f4adbef09018df519205cc8696e1f0f00a67196f0677e8484d949f2

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 167 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cbee76f080a3f8638f8d1cc0e1457adf5588a5ca44b56c5bf719bb5f57f0f2de

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 192 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 347026e609df7b4c783cbb5af4b7e65d899b71bdfd9b99de75fbf63a033ea74f

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 494 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e356f94cb14b1e3c53975eb33c18f36f0c9dd1b4866940d6e243d2063546fa30

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 172 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4dca530d4682ddf6f4b9053173c007f95875c2634a6b61c9573d93fc21483766

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 296 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 296d8f67dcf848a35385d138a46404f00c21f1a8eb22249473ddd9aab1f411ab

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 310 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c575ff79d199955e3aba19296142cf49cd7bcdcf7317f8a17bed8d349f9a7388

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 200 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dc197b30cca0477fd82b1c175af0ed1008687e12d9dff7f75c417f959c1830ae

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 404 favicon.ico
navmelding0.com/ 708 B
948 B 56ms
56ms Other
text/html 91.215.85.79
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://navmelding0.com/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 91.215.85.79 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software: /
Resource Hash: 37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa

Request headers

Referer: https://navmelding0.com/pages?d=nordea
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Aug 2024 22:52:39 GMT
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 708
content-type: text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BankID (Banking)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			navmelding0.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 97f5e601bfeb261e51e8e21148690d73

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://navmelding0.com/static/bifrost/js/oidc-client.min.js?1.1.0-7+274bc17a Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://navmelding0.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

csfe.bankid.no
navmelding0.com
193.26.146.36
91.215.85.79
0f701714eca75339b36fb25a551ab035e6ac88cbf1854fa3c5e4c794d43a3fb7
296d8f67dcf848a35385d138a46404f00c21f1a8eb22249473ddd9aab1f411ab
2fbbbda646f6c6004b2f3670d40a1ad4d5df6c8a0089943845aa5fe55a749e92
347026e609df7b4c783cbb5af4b7e65d899b71bdfd9b99de75fbf63a033ea74f
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
4bdc871a71df801aa86926434d6fbed9744ec4757af4e9d6d40978724ea59134
4dca530d4682ddf6f4b9053173c007f95875c2634a6b61c9573d93fc21483766
5b056148977cddad1d04190e8588f71549f5fbce2c8504fd0a52699a451896ca
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
68865208ac1cc3b9a6a8bf2e7a8c6e95d90be33bbfd73bb9c682034199f176a4
6a191c4d1f4adbef09018df519205cc8696e1f0f00a67196f0677e8484d949f2
91e212c00720ecc2b72ec531f8b6ac7145f8054574918e6d4014a9438609c536
a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8
a1f96af0ff80beee233dd05a75843e48337554f85d93f5c533cb42bc8045220e
bc795cf00117d34096de8876731329301cb631c7cc5b33cd34d56ec87b917822
c080371fd384e40ac7de4153b9a05b57a21362ce1f69d1f7ac7af1e28a6fc1e7
c575ff79d199955e3aba19296142cf49cd7bcdcf7317f8a17bed8d349f9a7388
cbee76f080a3f8638f8d1cc0e1457adf5588a5ca44b56c5bf719bb5f57f0f2de
dc197b30cca0477fd82b1c175af0ed1008687e12d9dff7f75c417f959c1830ae
e356f94cb14b1e3c53975eb33c18f36f0c9dd1b4866940d6e243d2063546fa30
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e64e9d464beb9fe2717cd8bd8d093bb04d570f08a15c65f14533733904e12be7
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

navmelding0.com Open in urlscan Pro 91.215.85.79 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

77 kBTransfer

358 kBSize

1 Cookies

0 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 12 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

1 Cookies

2 Console Messages

Indicators

navmelding0.com Open in urlscan Pro
91.215.85.79 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

77 kB
Transfer

358 kB
Size

1
Cookies

13 HTTP transactions
12 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!